Huawei vs Cisco vs MikroTik: choosing network gear for an SMB

Every few months a client asks us the same question in different words: "What switches and routers should we actually buy?" The honest answer is that there is no single right vendor — there is a right fit for your budget, your in-house skills, and how much you value a support contract you can escalate to at 3am. We deploy and maintain all three of these, so this is not a sales pitch for one of them. It is how we decide.

The three, in one sentence each

• •Cisco is the default enterprise standard: the deepest feature set, the largest talent pool, the best formal support — and the highest total cost, much of it now recurring licensing.
• •MikroTik is the price-performance outlier: enterprise routing features (BGP, OSPF, MPLS, VPN, firewall) on hardware that costs a fraction of the alternatives — if you have, or hire, someone who knows RouterOS.
• •Huawei sits in between: enterprise-grade switching and routing at noticeably lower cost than Cisco, with a CLI and feature set that Cisco engineers pick up quickly — carrying a procurement question you should answer up front.

Cost is not the price tag

The sticker price is the smallest part of the decision. What actually separates these vendors over a five-year life is licensing and support.

Cisco's modern campus gear (the Catalyst 9000 line) has two licensing layers. There is a perpetual base licence — Network Essentials or Network Advantage — that enables the on-box switching and routing and never expires. On top of it sits a term subscription (Cisco DNA, now branded Cisco Networking), mandatory at the time of purchase, typically 3, 5, or 7 years, that unlocks the controller and cloud features: Catalyst Center automation, assurance, SD-Access. The distinction matters: when the subscription lapses the switch keeps forwarding on its perpetual base — you lose the subscription features, not the box. Meraki, Cisco's cloud-managed line, is stricter. A Meraki licence comes with a 30-day grace period after it expires; past that, an unlicensed device stops passing traffic — under co-termination licensing the whole organisation is locked out, under per-device licensing only the expired device. Either way the recurring cost buys real things (TAC support, cloud management, feature updates), but you must budget the subscription as opex, not a one-time capex.

MikroTik is the opposite model. RouterOS licences are cheap and perpetual — the licence level is tied to the device and does not expire. The Cloud Hosted Router (CHR), which runs RouterOS as a VM on your own x86 or in a cloud, has a free tier capped at 1 Mbit/s per interface, with inexpensive perpetual tiers above it (P1, P10 and Unlimited — 1 Gbit/s, 10 Gbit/s and uncapped per interface). There is no annual licence tax. What you pay instead is in expertise and support: MikroTik's support is documentation, a large community, and your reseller — not a 24/7 vendor TAC with an SLA.

Huawei's enterprise licensing is lighter than Cisco's — many features are on-box rather than subscription — and the hardware is typically cheaper for comparable throughput and port density. Support runs through Huawei's enterprise partner channel rather than a Cisco-style universal TAC brand, so the quality depends on your partner.

Skills are the real constraint

A vendor you cannot operate is a liability, however good the hardware.

Cisco has the largest pool of certified engineers on the planet. If you standardise on Cisco, hiring or contracting someone who already knows it is easy, and almost every network problem you will hit has been documented a thousand times. That liquidity of talent is a genuine, underrated feature.

MikroTik is powerful precisely because it exposes everything — which is also why it punishes the casual user. RouterOS does not hold your hand; a misordered firewall rule or a misunderstood routing mark will bite you. In the hands of someone who knows it, a €500 MikroTik router will do what a much more expensive box does. In the hands of someone who does not, it becomes an outage waiting to happen. The learning curve is the price of admission.

Huawei's VRP command line is close enough to Cisco IOS that an experienced network engineer is productive quickly, though the talent pool is smaller in Europe than Cisco's and the documentation is not always as thorough in English.

The Huawei question you should answer first

Be honest about this before you standardise on Huawei: there are procurement and regulatory considerations, and they depend entirely on who you are and where the gear sits.

In the United States, federal agencies and their contractors face restrictions on Huawei equipment, and there are limits tied to telecom carrier networks. In the EU, the "5G Security Toolbox" led several member states to restrict or remove Huawei from mobile-carrier core networks, and some governments extend caution further. None of that automatically applies to an ordinary company buying campus switches for its own office LAN in Cyprus or elsewhere in the EU — that is legal and common. But if you sell to government, work in regulated sectors, or expect due-diligence questions from enterprise customers, factor the vendor's reputation into the decision now rather than discovering it in a security questionnaire later.

How we actually choose

In practice the best network is often not single-vendor. We regularly run MikroTik at the edge for routing, VPN and firewalling — where its flexibility and price shine, as in our write-up on MikroTik CHR and OSPF for redundant VPNs — behind or alongside Cisco or Huawei access switches where port density, PoE and a support contract matter. Standardising the *management* and the *documentation* matters more than standardising the badge on the box.

What we do

We are vendor-neutral by design: we service Cisco, MikroTik and Huawei, so our advice is shaped by your constraints, not a distributor quota. That means we will tell you when the cheap MikroTik is the right answer and when it is a false economy, when Cisco's licensing is worth it and when you are paying for a brand you do not need. What we standardise for every client is the part that actually prevents outages — a documented configuration in your hands, monitored 24/7, with a rollback path — regardless of whose hardware is in the rack.